Plan for Soft Target Security: Build in Security for Mass Gatherings Starting With Your Planning

Our nation has experienced too many violent attacks against the places in our communities where we should feel safest. These attacks have targeted crowded places and community members in public venues where they gather to learn, socialize, worship, and patronize local businesses.

The Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) prioritizes increasing the security of public gathering areas. Although not every attack will be able to be stopped, any that can be avoided through preparedness is an improvement in our security.

During this year’s Infrastructure Security Month, the theme of “Infrastructure Security: Build It In” reminds all audiences that it is important to consider infrastructure security and resilience from design concept all the way through development and implementation. Considering all aspects of infrastructure security is especially important when planning for mass gatherings of any kind.

As we have seen in recent events, organizers and event hosts must prepare for and plan for all situations, including non-malicious events. It is essential that venues properly account for the available space and appropriately determine site capacity to prevent crowd surge in a standing room environment. It is critical that crowd control plans be set in place. Communication must be made to attendees to ensure they are aware of their nearby exits and have ample space to limit crowd heat exhaustion and allow room to escape in the event of an emergency.

DHS Protective Security Advisers encourage business and organizations to plan with and follow a specific method to improve the security of their mass gathering events. This method, known as Connect, Plan, Train, and Report helps to better prepare a business or organization to proactively think about the role they play in the safety and security of their communities, and therefore become better equipped to handle a crisis, or avoid the occurrence of one altogether.


Businesses and organizations should make it a priority to connect, form and maintain relationships with local law enforcement, fire rescue, and other businesses in their proximity. Businesses should make sure that all emergency response duties are clear between venue security and emergency response stakeholders. Additionally, sharing all pertinent information regarding the event and venue layout with law enforcement, fire rescue and emergency management teams ahead of time is key to improving any emergency response that may be necessary.


Aside from planning the event itself, business must also plan for any emergency response and communications that may be necessary, as well as for the security and business continuity. This means having plans in place in case of scenarios such as bomb threats, active shooters, and other attacks that mass gatherings are vulnerable to. There must be procedures in place for evacuating the venue if the need arises. There should also be a procedure in place for public address announcements to keep all attendees informed of any developing information or situations.


All staff, volunteers, and people in positions of authority should be properly and thoroughly trained on security basics, emergency response, emergency communications, and business continuity plans. All personnel should be equipped to stay aware of suspicious activity and know how to handle an active shooter scenario and what to do when suspicious items or packages are found unattended. There should also be special personnel who will have heightened responsibilities in case of an emergency, these employees should receive specialized training to aid in the implementation of their additional response actions. Lastly, there must be exercises conducted to ensure that all plans of response are understood, actionable, and remain applicable. Ideally, first responders would be included in the exercise for them to become familiar with the venue and all security plans, policies, and procedures.


Authorized personnel, staff, and volunteers must not only be trained on staying aware of suspicious behavior, activities, or items, but also be trained and encouraged to report anything suspicious they see. Recognizing and reporting something suspicious before it becomes a threat could be crucial in maintaining the security of the mass gathering, and all personnel should be aware of how to identify a variety of different security concerns. Establishing a system for reporting safety concerns and sharing details on the reporting system is crucial.

The Connect, Plan, Train, and Thinkframework is encouraged by the DHS to help protect soft targets and crowded spaces. During this Infrastructure Security Month, take a moment for introspection and consider what practices you and your organization have in place to reduce the risk of security threats at a mass gathering event. Remember, it’s never too late to reduce your risk by building in better infrastructure security. Learn more about Infrastructure Security Month at

How can IEM help with your after actions and training exercises?  Find out more.